Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

8b758ccdfb...e9.exe

windows7-x64

7

8b758ccdfb...e9.exe

windows10-2004-x64

7

a1b468e955...5f.exe

windows7-x64

7

a1b468e955...5f.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Win32.GhostSec.zip

  • Size

    7.8MB

  • MD5

    fc111eb72cd394a0dc6c785f321745ad

  • SHA1

    5223db383114366949a1eaf3a25db69cde5c528a

  • SHA256

    90a2d935dcd1ea5a18ffb8194f9a8893ca2f62c9deaccbc8c94855b770387ea2

  • SHA512

    c790890f715332db9f4b37c1ab9b3011c5f7ef338af55b966b00bd096bbe1a2c0acfe35f7b8a7cecaa1b7c03a6fad16c435bd5348b5f20798f76f6c4ecfafdaf

  • SSDEEP

    196608:xI+eYXW7cupNAYIP7z7LpMHPLlGn5ymyp0fdcgAEZ:xU8eFcfT/ivhMymVcV+

Score
10/10
ghostlocker

Malware Config

Extracted

Family

ghostlocker

C2

http://94.103.91.246/addInfection

http://94.103.91.246/incrementLaunch

Signatures

  • Ghostlocker family
    ghostlocker
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • Win32.GhostSec.zip
    .zip

    Password: infected

  • 8b758ccdfbfa5ff3a0b67b2063c2397531cf0f7b3d278298da76528f443779e9
    .exe windows:6 windows x64 arch:x64

    4f2f006e2ecf7172ad368f8289dc96c1


    Headers

    Imports

    Sections

  • a1b468e9550f9960c5e60f7c52ca3c058de19d42eafa760b9d5282eb24b7c55f
    .exe windows:6 windows x64 arch:x64

    4f2f006e2ecf7172ad368f8289dc96c1


    Headers

    Imports

    Sections